General

  • Target

    3ff18431ade299b48e8b582611d87ca7309600d381e6aabfcbd002564219a002

  • Size

    436KB

  • Sample

    220630-wjd6gsgfh3

  • MD5

    92da801f6ecd5c19af68d5cac87995af

  • SHA1

    12cd0ee9f1f7d1c2ebd331b4c2566069c5c4e485

  • SHA256

    3ff18431ade299b48e8b582611d87ca7309600d381e6aabfcbd002564219a002

  • SHA512

    3492b2198fba546e2d608f2735b476e14603d30a59b47650f7c60420284e57e5db705e53a93470398cd5f03c5211e980ef81293ef982beeda241948bf49c06cc

Malware Config

Extracted

Family

lokibot

C2

http://185.165.29.49/enesb/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

    • Target

      3ff18431ade299b48e8b582611d87ca7309600d381e6aabfcbd002564219a002

    • Size

      436KB

    • MD5

      92da801f6ecd5c19af68d5cac87995af

    • SHA1

      12cd0ee9f1f7d1c2ebd331b4c2566069c5c4e485

    • SHA256

      3ff18431ade299b48e8b582611d87ca7309600d381e6aabfcbd002564219a002

    • SHA512

      3492b2198fba546e2d608f2735b476e14603d30a59b47650f7c60420284e57e5db705e53a93470398cd5f03c5211e980ef81293ef982beeda241948bf49c06cc

    • Lokibot

      Lokibot is a Password and CryptoCoin Wallet Stealer.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Tasks